Subaru Starlink: Difference between revisions
Elaborated on the method used to hack starlink |
m improve references with additional information |
||
| Line 16: | Line 16: | ||
Inside the admin portal any employee had access to a range of personal information, largely comprised of the personal information listed below. Additionally the employee the hacker had login as had level 2 access allowing them to remotely lock, unlock, honk, issue speeding warnings and more which they demonstrated on their own and a friend's Subaru car. | Inside the admin portal any employee had access to a range of personal information, largely comprised of the personal information listed below. Additionally the employee the hacker had login as had level 2 access allowing them to remotely lock, unlock, honk, issue speeding warnings and more which they demonstrated on their own and a friend's Subaru car. | ||
The incident was initially ethically disclosed to Subaru on 24-20-11 with a blog post detailing the exploit released on 25-23-01<ref>https://samcurry.net/hacking-subaru - | The incident was initially ethically disclosed to Subaru on 24-20-11 with a blog post detailing the exploit released on 25-23-01<ref>{{Cite web |last=Curry |first=Sam |date=23 Jan 2025 |title=Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel |url=https://samcurry.net/hacking-subaru |access-date=2025-02-19 |website=samcurry.net}}</ref> | ||
==Data collection== | ==Data collection== | ||
===Types of data collected=== | ===Types of data collected=== | ||
Subaru’s privacy policy and STARLINK terms of service specify that the following data may be collected:<ref name="SubaruPrivacy"> | Subaru’s privacy policy and STARLINK terms of service specify that the following data may be collected:<ref name="SubaruPrivacy">{{Cite web |date= |title=Subaru Privacy Policy |url=https://www.subaru.com/support/privacy-policies.html |access-date=2025-01-16 |website=subaru.com}}</ref> | ||
*'''Personal information''' | *'''Personal information''' | ||
| Line 44: | Line 42: | ||
===Collection methods=== | ===Collection methods=== | ||
Data collection is performed through: | Data collection is performed through: | ||
*Vehicle sensors and diagnostic modules.<ref name="MozillaReview"> | *Vehicle sensors and diagnostic modules.<ref name="MozillaReview">{{Cite web |last=Mozilla Research |first= |date=15 Aug 2023 |title=Mozilla Foundation Privacy Review: Subaru |url=https://foundation.mozilla.org/en/privacynotincluded/subaru/ |access-date=2025-01-16 |website=foundation.mozilla.org}}</ref> | ||
*GPS tracking systems. | *GPS tracking systems. | ||
*Cellular-connectivity modules. | *Cellular-connectivity modules. | ||
| Line 52: | Line 50: | ||
===Third-party data sharing=== | ===Third-party data sharing=== | ||
Subaru shares data with several entities, including: | Subaru shares data with several entities, including: | ||
*Data brokers, such as LexisNexis<ref name="SubaruPrivacy" /> and Verisk.<ref name="TorqueNews"> | *Data brokers, such as LexisNexis<ref name="SubaruPrivacy" /> and Verisk.<ref name="TorqueNews">{{Cite web |last=Flierl |first=Denis |date=21 May 2024 |title=Vehicle Data Collection Lawsuit |url=https://www.torquenews.com/1084/subaru-now-involved-vehicle-data-collection-lawsuit-investigation |access-date=2025-01-16 |website=torquenews.com}}</ref><ref name="NYT">{{Cite web |last=Hill |first=Kashmir |date=11 March 2024 |title=Automakers Are Sharing Drivers’ Data |url=https://www.nytimes.com/2024/03/11/technology/carmakers-driver-tracking-insurance.html |access-date=2025-01-16 |website=nytimes.com}}</ref> | ||
*Insurance companies for risk assessment and pricing.<ref name="TorqueNews" /> | *Insurance companies for risk assessment and pricing.<ref name="TorqueNews" /> | ||
*Marketing firms. | *Marketing firms. | ||
| Line 75: | Line 73: | ||
*Submitting detailed personal information. | *Submitting detailed personal information. | ||
*Potentially long response times. | *Potentially long response times. | ||
*No verification mechanism for successful opt-out.<ref name="ConsumerForum"> | *No verification mechanism for successful opt-out.<ref name="ConsumerForum">{{Cite web |date=26 Jan 2025 |title=Privacy Report Discussion |url=https://www.subaruoutback.org/threads/privacy-not-included-subaru-report-connected-services-etc.556583/ |access-date=2025-01-16 |website=subaruoutback.org}}</ref> | ||
===Legal challenges=== | ===Legal challenges=== | ||
| Line 88: | Line 86: | ||
*Embedded telematics devices. | *Embedded telematics devices. | ||
*4G LTE cellular networks. | *4G LTE cellular networks. | ||
*GPS receivers and cloud-based data-processing systems.<ref name="StarlinkTerms"> | *GPS receivers and cloud-based data-processing systems.<ref name="StarlinkTerms">{{Cite web |title=Subaru STARLINK Terms and Conditions |url=https://www.subaru.com/support/terms-and-conditions/subaru-starlink/subaru-starlink-services.html |access-date=2025-01-16 |website=subaru.com}}</ref> | ||
===Data transmission=== | ===Data transmission=== | ||
| Line 110: | Line 108: | ||
[[Category:Automotive privacy]] | [[Category:Automotive privacy]] | ||
[[Category:Data | [[Category:Data collection]] | ||
[[Category:Consumer rights]] | [[Category:Consumer rights]] | ||
Revision as of 14:39, 10 March 2025
Subaru Starlink
| Basic Information | |
|---|---|
| Release Year | 2013 |
| Product Type | Software |
| In Production | Yes |
| Official Website | https://subaru.com/ |
Overview
Starlink is a connectivity service equipped on most modern Subaru vehicles, enabling extensive data collection from the vehicle and its occupants. The service has faced significant criticism and legal challenges over privacy concerns related to its data-collection and -sharing practices.[1]
Incident
The exploit was achieved by intercepting the Starlink app's network requests which revealed the admin portal login screen. Using the "Reset password" feature of the admin portal which was hidden with javascript the hacker found an employee email off linkedin and successfully managed to login to the admin portal. Although implementing 2FA this too was entirely client-side and the modal window blocking further interaction without verification could also be hidden with javascript.
Inside the admin portal any employee had access to a range of personal information, largely comprised of the personal information listed below. Additionally the employee the hacker had login as had level 2 access allowing them to remotely lock, unlock, honk, issue speeding warnings and more which they demonstrated on their own and a friend's Subaru car.
The incident was initially ethically disclosed to Subaru on 24-20-11 with a blog post detailing the exploit released on 25-23-01[2]
Data collection
Types of data collected
Subaru’s privacy policy and STARLINK terms of service specify that the following data may be collected:[3]
- Personal information
- Names, addresses, and contact details.
- Phone numbers and email addresses.
- Social-security numbers (in specific cases).
- Driver's license numbers.
- Vehicle identification numbers (VIN).
- Vehicle data
- Location and GPS coordinates.
- Speed, acceleration, and braking patterns.
- Time and duration of trips.
- Maintenance and diagnostic information.
- Sensor data, such as crash severity, tire pressure, and coolant temperature.
- Audio and biometric data
- Audio recordings through onboard microphones.
- Voice data from STARLINK service-center calls.
- Biometric data from systems that driver attention.
- Search content and commands issued by occupants.
Collection methods
Data collection is performed through:
- Vehicle sensors and diagnostic modules.[1]
- GPS tracking systems.
- Cellular-connectivity modules.
- STARLINK mobile apps and web portals.[1]
Data sharing and sales
Third-party data sharing
Subaru shares data with several entities, including:
- Data brokers, such as LexisNexis[3] and Verisk.[4][5]
- Insurance companies for risk assessment and pricing.[4]
- Marketing firms.
- Emergency services and law enforcement (when required by law).
- Subaru dealerships and distributors.
- Third-party service providers.[3]
Insurance-industry usage
Data brokers aggregate and sell this information to insurance companies, who may:
- Increase insurance premiums based on driving patterns.
- Monitor driving behaviors to assess risk.
- Use driving data for personalized coverage offerings.[5]
Privacy concerns
Consent issues
Key concerns include:
- Simply being a passenger in a STARLINK-equipped vehicle constitutes consent.[1]
- Lack of active notification during data collection.
- Limited opt-out options that might impact vehicle functionality.
Difficulties in opting out
Subaru’s opt-out process involves:
- Submitting detailed personal information.
- Potentially long response times.
- No verification mechanism for successful opt-out.[6]
Legal challenges
Subaru faces legal scrutiny for:
- Allegations of insufficiently disclosing its data-collection policies what it does with data.
- Potential non-compliance with privacy laws.
- Class-action lawsuit investigations over consent practices.[4]
Technical details
System architecture
STARLINK is built upon:
- Embedded telematics devices.
- 4G LTE cellular networks.
- GPS receivers and cloud-based data-processing systems.[7]
Data transmission
- Real-time data transmission through LTE networks.
- Local storage when connectivity is unavailable.[7]
Consumer-protection issues
Privacy rights
Critics cite:
- Minimal control over data retention.
- Broad sharing permissions in privacy policies.
- Limited transparency about how data is used.[1]
Economic harm
- Insurance-rate adjustments based on driving data.
- Subscription fees for connected services.
- Potential effects on vehicle resale value.[5]
References
- ↑ 1.0 1.1 1.2 1.3 1.4 Mozilla Research (15 Aug 2023). "Mozilla Foundation Privacy Review: Subaru". foundation.mozilla.org. Retrieved 2025-01-16.
- ↑ Curry, Sam (23 Jan 2025). "Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel". samcurry.net. Retrieved 2025-02-19.
- ↑ 3.0 3.1 3.2 "Subaru Privacy Policy". subaru.com. Retrieved 2025-01-16.
- ↑ 4.0 4.1 4.2 Flierl, Denis (21 May 2024). "Vehicle Data Collection Lawsuit". torquenews.com. Retrieved 2025-01-16.
- ↑ 5.0 5.1 5.2 Hill, Kashmir (11 March 2024). "Automakers Are Sharing Drivers' Data". nytimes.com. Retrieved 2025-01-16.
- ↑ "Privacy Report Discussion". subaruoutback.org. 26 Jan 2025. Retrieved 2025-01-16.
- ↑ 7.0 7.1 "Subaru STARLINK Terms and Conditions". subaru.com. Retrieved 2025-01-16.